Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
497
4
1
1
Contributors
179
113
95
78
14
Categories
426
334
222
151
83
Platforms
458
23
15
14
13
Products / Services
466
447
32
10
5
MITRE Techniques
275
174
66
60
58
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
204
121
90
51
8
Detects established TLS traffic originating from the internal network to external destinations on TCP port 99. This port is commonly used in legacy or non-standard configurations and, when combined with TLS, may indicate C2 relay infrastructure or unauthorized exfiltration channels.
This rule detects internal network traffic communicating with the Telegram Bot API endpoint 'api.telegram.org' using the 'getUpdates' method. This pattern is commonly used by malware for C2 polling to retrieve commands from an adversary-controlled Telegram bot.
Detects outbound HTTPS traffic on non-standard ports that matches a specific JA3 fingerprint associated with the Sliver command and control framework. This indicates potential beaconing or C2 communication from a compromised host.
Detects outbound network traffic from internal hosts to the domain 'avenger-sync.live' over TLS port 443, which is associated with PamStealer stage-two command and control communication.
Detects HTTP traffic patterns associated with default Cobalt Strike malleable C2 profiles, specifically identifying requests to /submit.php or /dpixel and the use of the default 'Mozilla/4.0 (compatible; MSIE 8.0;' User-Agent string.
Detects network requests originating from common package manager User-Agents (e.g., pip, npm, cargo) targeted at external domains that do not match known legitimate repositories. This behavior is indicative of potential command and control (C2) activity or malicious package staging using lookalike or arbitrary domains to bypass standard package registry traffic patterns.
This rule detects network traffic directed at 'goldsky.arweave.net', a domain known to be used by the TukTuk malware as a dead-drop resolver. Adversaries often use legitimate web services like Arweave to host command-and-control (C2) configuration data, such as secondary C2 IP addresses or domains, allowing them to redirect infected hosts to backend infrastructure while masking the traffic as legitimate web communication.
Detects HTTP traffic patterns associated with default Cobalt Strike malleable C2 profiles, specifically identifying requests to /submit.php or /dpixel and the use of the default 'Mozilla/4.0 (compatible; MSIE 8.0;' User-Agent string.
Detects network traffic consistent with the Metasploit Meterpreter reverse HTTPS payload, specifically looking for the default 'CN=metasploit' certificate subject name used by the framework in SSL/TLS handshakes, or connections targeting default Meterpreter ports like 4444.
Detects network traffic consistent with the default configuration of a Cobalt Strike Malleable C2 Beacon. The rule identifies HTTP GET requests to a '/updates' URI path, accompanied by the specific default User-Agent string 'Mozilla/4.0 (compatible; MSIE 6.0)', which is commonly observed in uncustomized Cobalt Strike deployments.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards known attacker-controlled command-and-control domains associated with AsyncRAT and ScreenConnect abuse.
This rule detects potential command and control (C2) beaconing activity using DNS tunneling. It monitors for a high frequency of DNS TXT record queries to long subdomains (exceeding 50 characters), which is a common characteristic of tools like DNScat and iodine that encode data within DNS requests.
This rule detects potential Cobalt Strike Beacon check-in activity over HTTP. It identifies incoming GET requests where the URI is abnormally short and the HTTP Referer header is missing, which are common indicators of default Cobalt Strike malleable C2 profiles.
This rule detects repeated DNS queries to known Dynamic DNS (DDNS) providers within a 24-hour window, which may indicate an infected host beaconing to a command-and-control (C2) server utilizing dynamic infrastructure. Such rotation is commonly used by malware to maintain connectivity if primary infrastructure is blocked.
This rule monitors network traffic for specific command-and-control (C2) communication patterns associated with the Ousaban banking trojan. It detects response packets from an external server to a client machine containing JSON-like structural indicators such as 'inicio{', 'host', and 'porta' followed by '}fim'.
Detects HTTP traffic containing a specific session cookie pattern characteristic of PowerShell Empire C2 agent communication, utilizing regex to identify base64-encoded session identifiers.
Detects high-frequency DNS query patterns characterized by long, potentially encoded, subdomain labels (exceeding 40 characters) that are indicative of DNS-based command and control (C2) beaconing activity.
This rule detects potential command and control (C2) activity leveraging DNS tunneling. It identifies high-frequency DNS queries that contain unusually long subdomain labels (51 characters or more), which is a common technique used to encode data or commands within DNS protocol traffic to bypass network security controls.
Detects HTTP beaconing activity indicative of Cobalt Strike Malleable C2 communication. The rule monitors for specific URI patterns ('/updates', '/pixel', '/submit.php') in combination with a default User-Agent string commonly used by Cobalt Strike malleable profiles.
Detects outbound HTTPS traffic on high ports where the TLS SNI header consists of a 8-20 character random alphanumeric string. This pattern is indicative of default configurations for Metasploit Meterpreter Reverse HTTPS payloads attempting to establish a Command and Control connection.
Detects HTTP beaconing activity to a /submit.php URI with a default Cobalt Strike User-Agent string. This is indicative of a default or poorly customized Cobalt Strike malleable C2 profile being used for command and control communication.
Page 21 of 24